Office 365 Data at Rest Encryption


– Hi I’m Sunitha from Microsoft. In addition to the operational
controls and processes that govern access to customer data, Microsoft uses encryption
to safeguard customer data and help you maintain control over it. This video will walk you through how Office 365 data is encrypted at rest. We’ll dive into several
encryption key management options which are available to further
meet your business needs and compliance obligations. For data at rest Office 365 uses various encryption technologies like BitLocker and service encryption. BitLocker offers volume level encryption by encrypting the physical
disk containing customer data. This helps reduce the risk
of data being compromised if the physical disk is stolen. Service encryption provides
an added layer of encryption beyond BitLocker at the obligation level. Such as files and mailboxes in Office 365. It also offers strong
separation of server admin roles and customer data, while
providing an added layer of protection against physical data theft. Service encryption also provides
the option for customers to control and manage
their own encryption keys. For customers who have
compliance requirements that call out certain key arrangements with their cloud service provider, we provide several encryption
key management options to meet their business needs. Microsoft managed keys are
when the encryption keys are stored and managed by Microsoft. With Microsoft managed keys, the service manages the encryption keys and removes the burden of provisioning and managing the keys for the customer. Customer-managed keys
are when the customer generates and imports keys into the hardware security
module in Azure Key Vault and manages the keys from Azure Key Vault. In service encryption,
these customer-managed keys are used to encrypt files
and mailboxes in Office 365. Now let’s take a look
at customer-managed keys in more detail. In instances where customers
have compliance obligations regarding specific
encryption key arrangements with their cloud service provider, Office 365 offers them
an option to provide and control their own encryption
keys for service encryption through a feature called Customer Key. With Customer Key,
organizations can provide and control their encryption keys for their Office 365 data at rest at the application level. With Customer Key, customers may exercise their
control and revoke their keys should they decide to exit the service. By revoking access to the keys, the data is unreadable to the service and will put the customer
on path towards data purge. Keep in mind, if the Office 365 service cannot reach your keys
to operate the service due to a situation like
mismanaging or losing the keys, this will result in a loss
of service or data or both. To help reduce this risk, Customer Key includes an Availability Key. The Availability Key is a root key that is provisioned automatically when the tenant admin creates
a data encryption policy. The Availability Key
is stored and protected within Office 365 with no standing access and it is functionally
similar to the two root keys that are supplied by the customer for use with service encryption
using customer key. Availability Key is accessed if and only if both customer or root
keys are not reachable. Storage and control of
the Availability Key are deliberately different
from customer owned Azure Key Vault keys for three reasons. First, the Availability Key
provides high availability in the event that Office 365 services are unable to reach keys
hosted in Azure Key Vault. Second, the Availability Key provides a break glass capability in the event that both Azure Key Vault
keys are mismanaged. Third, the separation of logical controls provides defense in-depth
and protects against the loss of all keys from a rogue admin. Sharing the responsibility
to protect the keys while using a variety of protections and processes for key management, ultimately reduces the
risks that all keys, and therefore your data,
will be lost or destroyed. Microsoft provides you with sole authority over the destruction of
the Availability Key. By design, no one at Microsoft has access to the Availability Key. It is only accessible by
the Office 365 service code. Microsoft uses multiple
encryption methods, protocols and ciphers across
its products and services to help protect the
confidentiality of customer data that is stored within Office 365. Our practices meet
stringent industry standards for encryption use. Key management is an essential element of encryption best practices
and Microsoft works to ensure that encryption keys are properly managed. For most customers, this
meets their business needs. But for those who have
compliance obligations that require them to provide and control their own encryption keys, Microsoft supports this
with customer-managed keys. Lastly, encryption can
be a useful technology to help customers meet
their compliance needs and added data protection. However, it should not
be used in isolation. We recommend customers consider additional data protection capabilities to complement the encryption solutions
offered in Office 365. Thanks for watching. For additional papers and guidance, please visit the Service Trust Portal.

Leave a Reply

Your email address will not be published. Required fields are marked *